* apt-pkg/acquire-item.cc:

  - if no Release.gpg file is found, still load the hashes for
    verification (closes: #636314) and add test

diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index 215615bdddc27ff89642b20a65e2d8316674e614..ebd8d5a12344ade6a4e980b6fd833bccf6c15c15 100644 (file)
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -1258,8 +1258,9 @@ void pkgAcqMetaIndex::Done(string Message,unsigned long Size,string Hash, /*{{{*
       if (SigFile == "")
       {
          // There was no signature file, so we are finished.  Download
-         // the indexes without verification.
-         QueueIndexes(false);
+         // the indexes and do hashsum verification
+         MetaIndexParser->Load(DestFile);
+         QueueIndexes(true);
       }
       else
       {

diff --git a/debian/changelog b/debian/changelog
index 1dec5dce07240edc01e25b67c222100db4632910..f162e20f47341dccf6462ec471f3bb1b10f7614f 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -13,6 +13,9 @@ apt (0.8.15.6) unstable; urgency=low
       (LP: #812862)
   * test/integration/test-hashsum-verification:
     - add regression test for hashsum verification
+  * apt-pkg/acquire-item.cc:
+    - if no Release.gpg file is found, still load the hashes for
+      verification (closes: #636314) and add test
 
  -- Michael Vogt <mvo@debian.org>  Tue, 12 Jul 2011 11:54:47 +0200
 

diff --git a/test/integration/test-hashsum-verification b/test/integration/test-hashsum-verification
index 29420c098816ffaf2eac41a51257e8a71347688c..033096ee8504a93f5fc60a79549ef0f4e68e9357 100755 (executable)
--- a/test/integration/test-hashsum-verification
+++ b/test/integration/test-hashsum-verification
@@ -70,6 +70,13 @@ runtest() {
         msgtest 'No Packages file in /var/lib/apt/lists'
         [ "$(ls rootdir/var/lib/apt/lists/*Package* 2>/dev/null)" = "" ] && msgpass || msgfail 
         
+        # now with the unsigned Release file
+        rm -rf rootdir/var/lib/apt/lists
+        rm aptarchive/InRelease aptarchive/Release.gpg
+        msgtest 'unsigned apt-get update gets the expected hashsum mismatch'
+       aptget update 2>&1 | grep "Hash Sum mismatch" > /dev/null && msgpass || msgfail
+
+
 }
 
 runtest